Advanced Classifieds Directory Pro
Monthly
Sensitive information exposure in the Advanced Classifieds & Directory Pro WordPress plugin (versions through 3.4.2) allows unauthenticated remote attackers to retrieve custom field listing data via the publicly accessible AJAX action `acadp_public_custom_fields_listings`, bypassing WordPress authentication entirely. A publicly available proof-of-concept has been published by WPScan, though EPSS places exploitation probability at the 1st percentile, suggesting limited observed exploitation to date. No CISA KEV listing exists, and a vendor-released patch is available in version 3.4.3.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sensitive information exposure in the Advanced Classifieds & Directory Pro WordPress plugin (versions through 3.4.2) allows unauthenticated remote attackers to retrieve custom field listing data via the publicly accessible AJAX action `acadp_public_custom_fields_listings`, bypassing WordPress authentication entirely. A publicly available proof-of-concept has been published by WPScan, though EPSS places exploitation probability at the 1st percentile, suggesting limited observed exploitation to date. No CISA KEV listing exists, and a vendor-released patch is available in version 3.4.3.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.